Read the docs
TI-2025-40901 Aliases CVE-2025-66474GHSA-9xc6-c2rm-f27p

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Priority HIGH 73CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.

Summary

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01021 63rd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed xwiki-rendering (xwiki): 16.10.10, 17.4.3, 17.6.0-rc-1org.xwiki.rendering:xwiki-rendering-xml (Maven): 16.10.10, 17.4.3, 17.6.0-rc-1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-renderingbefore 16.10.10; 17.0.0-rc-1 to before 17.4.3; 17.5.0-rc-1 to before 17.6.0-rc-116.10.10, 17.4.3, 17.6.0-rc-1Patch availableCNA
—org.xwiki.rendering:xwiki-rendering-xml (Maven)before 16.10.1016.10.10Patch availableGHSA-9xc6-c2rm-f27p
—org.xwiki.rendering:xwiki-rendering-xml (Maven)17.0.0-rc-1 to before 17.4.317.4.3Patch availableGHSA-9xc6-c2rm-f27p
—org.xwiki.rendering:xwiki-rendering-xml (Maven)17.5.0-rc-1 to before 17.6.0-rc-117.6.0-rc-1Patch availableGHSA-9xc6-c2rm-f27p
  • xwiki-rendering VendorXWiki Affected before 16.10.10; 17.0.0-rc-1 to before 17.4.3; 17.5.0-rc-1 to before 17.6.0-rc-1 Fixed in 16.10.10, 17.4.3, 17.6.0-rc-1 Patch available CNA
  • org.xwiki.rendering:xwiki-rendering-xml (Maven) Vendor— Affected before 16.10.10 Fixed in 16.10.10 Patch available GHSA-9xc6-c2rm-f27p
  • org.xwiki.rendering:xwiki-rendering-xml (Maven) Vendor— Affected 17.0.0-rc-1 to before 17.4.3 Fixed in 17.4.3 Patch available GHSA-9xc6-c2rm-f27p
  • org.xwiki.rendering:xwiki-rendering-xml (Maven) Vendor— Affected 17.5.0-rc-1 to before 17.6.0-rc-1 Fixed in 17.6.0-rc-1 Patch available GHSA-9xc6-c2rm-f27p

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*before 16.10.10; 17.0.0 to before 17.4.3VulnerableXWiki
cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:-:*:*:*:*:*:*17.5.0VulnerableXWiki
cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:rc1:*:*:*:*:*:*17.5.0 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:* Versions before 16.10.10; 17.0.0 to before 17.4.3 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:-:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:rc1:*:*:*:*:*:* Versions 17.5.0 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-rendering (xwiki) Fixed in 16.10.10, 17.4.3, 17.6.0-rc-1
  • Fix · GHSA-9xc6-c2rm-f27p org.xwiki.rendering:xwiki-rendering-xml (Maven) Fixed in 16.10.10 Advisory →
  • Fix · GHSA-9xc6-c2rm-f27p org.xwiki.rendering:xwiki-rendering-xml (Maven) Fixed in 17.4.3 Advisory →
  • Fix · GHSA-9xc6-c2rm-f27p org.xwiki.rendering:xwiki-rendering-xml (Maven) Fixed in 17.6.0-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66474
  2. 2026-10-03 Alias added: GHSA-9xc6-c2rm-f27p

References

Exploit 3

Patch 4

Advisory 1

Other 1

  • TI-2023-19345 XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro CVSS 3.1CRITICAL 10.0
  • TI-2023-19341 Cross-site scripting in xwiki-rendering CVSS 3.1CRITICAL 9.6
  • TI-2026-19446 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages CVSS 4.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences